A serious vulnerability in the Adobe Acrobat extension for Chrome allowed malicious web pages to silently extract conversations, contacts, and profile data from active WhatsApp Web sessions.
The flaw, identified as CVE-2026-48294 and dubbed HermeticReader, received a CVSS score of 7.4. It impacted every version of the extension up to 26.5.2.2 and was present in roughly 329 million browser installations.
Exploitation required only that a victim with the extension installed and a logged-in WhatsApp Web session visit an attacker-controlled address. No malware installation, password entry, or file clicks were necessary.
The attack chain leveraged internal pages reachable from the extension together with the absence of message-origin validation. The malicious site altered local storage to activate the Hermes integration feature originally built to connect Acrobat with WhatsApp Web.
By determining the numeric identifier of the open Chrome tab, the attacker could issue commands directly to the Acrobat component loaded inside WhatsApp Web. Visible page elements were manipulated and their rendered content copied into a hidden form that was then submitted to the attacker’s server.
Exposed information included contact names, the full list of conversations, message previews, the user’s profile name, and the complete text of any open chat. End-to-end encryption of the messaging service remained unbroken throughout the process.
Adobe released a fix in version 26.5.2.3, which was distributed automatically via the Chrome Web Store. At the time of disclosure, researchers had found no public indications that the vulnerability had been used in real-world attacks.
